Password Challenges in Microsoft Team

[osamamansoor]

Hi Experts,

We are using the Office 365 Business Essentials Service for the last 7 Years.

We have the following Setup.

1. Office 365 is connected with Azure AD for Sync User Name and Password of Local Active Directory with Office 365 Azure. (Pass-through Authentication)
2. We have Domain Controller with Single Forest and Multiple Domain Controller
3. Users are Configured with Multifactor Authentication

Problem :

Some users are not happy when their local AD Password changes after 30 Days (As Per Organizational Policy) the Microsoft Challenges them to re-enter newly change AD Password in some cases and MFA prompt however Microsoft Outlook 2013 (Desktop Version) does not ask to re-enter password the reason could be we had to save Application Password (App Password).

Also, One Drive Sync Client also asks for a re-authentication like Microsoft Team

Question :

Is there any way so we can bypass this password prompt / MFA prompt once a user changes the local AD Password.

[#2]

Do you mean only in that particular case and have MFA enabled for any other case?

[#3]

As soon as the password is reset in local AD, and this information is synced to Azure AD, Azure AD will determine that all active tokens are no longer valid and need to be refreshed. This requires the user to authenticate themselves again. You could decide to disable MFA for specific users, but then MFA is disabled under all circumstances (excluding possible Azure AD CA policies), something I do not recommend and you also do not want.

Update: I just realized that potentially you could try and see if Azure AD Connect can be prevented from syncing the last password change time. Which is used by Azure AD to determine if it needs to revoke refresh tokens. Not sure if this attribute can be excluded though. Also still wouldn't recommend it 🙂 

[#4]

@pvanberlo

Thanks for giving an explanation.

As i checked the behavior after changing Active Directory / Domain Password users has to enter New Domain Password and MFA Screen.

Lets assume if we disabled MFA but after changing Domain Password We have to enter new password.

Can we eliminate the whole challenging password screens ?

"I just realized that potentially you could try and see if Azure AD Connect can be prevented from syncing the last password change time. Which is used by Azure AD to determine if it needs to revoke refresh tokens. "

Do you think above can be workable scenario ?
Will Azure ADFS can resolve this issue ?

[#5]

Even when I had one of my domains set to federated, it would revoke refresh tokens when a password was changed and this info was synced back into Azure AD. To be fair, I've not tested it in a while and I primarily work with cloud only identities nowadays eliminating the need to even have a local AD.

If you disabled MFA, you'd still be presented with a screen to sign-in again anyhow.